@sarj/eslint-plugin 2.0.1 → 2.1.1

package/dist/index.js

@@ -321,9 +321,260 @@ var no_enum_default = ESLintUtils3.RuleCreator(
   }
 });
 
-// src/rules/no-raw-env.ts
+// src/rules/no-insecure-random-id.ts
 import { ESLintUtils as ESLintUtils4 } from "@typescript-eslint/utils";
-var no_raw_env_default = ESLintUtils4.RuleCreator(
+var NAME_PATTERN = /id|token|key|secret|uuid|nonce|session|password|salt/i;
+function isMathRandomCall(node) {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee.type !== "MemberExpression" || callee.computed) {
+    return false;
+  }
+  const { object, property } = callee;
+  return object.type === "Identifier" && object.name === "Math" && property.type === "Identifier" && property.name === "random";
+}
+function isPartOfToString36Chain(node) {
+  let current = node;
+  let parent = current.parent;
+  while (parent) {
+    if (parent.type === "MemberExpression" && parent.object === current && !parent.computed && parent.property.type === "Identifier" && parent.property.name === "toString") {
+      const grandparent = parent.parent;
+      if (grandparent && grandparent.type === "CallExpression" && grandparent.callee === parent) {
+        const firstArg = grandparent.arguments[0];
+        if (firstArg && firstArg.type === "Literal" && firstArg.value === 36) {
+          return true;
+        }
+      }
+    }
+    if (parent.type === "MemberExpression" && parent.object === current) {
+      current = parent;
+      parent = current.parent;
+      continue;
+    }
+    if (parent.type === "CallExpression" && parent.callee === current) {
+      current = parent;
+      parent = current.parent;
+      continue;
+    }
+    break;
+  }
+  return false;
+}
+function findEnclosingName(node) {
+  let current = node;
+  let parent = current.parent;
+  while (parent) {
+    if (parent.type === "VariableDeclarator" && parent.init === current) {
+      if (parent.id.type === "Identifier") {
+        return parent.id.name;
+      }
+      return void 0;
+    }
+    if (parent.type === "Property" && parent.value === current) {
+      const key = parent.key;
+      if (!parent.computed && key.type === "Identifier") {
+        return key.name;
+      }
+      if (key.type === "Literal" && typeof key.value === "string") {
+        return key.value;
+      }
+      return void 0;
+    }
+    if (parent.type === "PropertyDefinition" && parent.value === current) {
+      const key = parent.key;
+      if (!parent.computed && key.type === "Identifier") {
+        return key.name;
+      }
+      if (key.type === "Literal" && typeof key.value === "string") {
+        return key.value;
+      }
+      return void 0;
+    }
+    if (parent.type === "FunctionDeclaration" || parent.type === "FunctionExpression" || parent.type === "ArrowFunctionExpression" || parent.type === "BlockStatement" || parent.type === "ReturnStatement" || parent.type === "ExpressionStatement") {
+      return void 0;
+    }
+    current = parent;
+    parent = current.parent;
+  }
+  return void 0;
+}
+var no_insecure_random_id_default = ESLintUtils4.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-insecure-random-id",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead."
+    },
+    schema: [],
+    messages: {
+      insecureRandomId: "`Math.random()` is not cryptographically secure and is predictable; do not use it to generate IDs, tokens, or secrets. Use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isMathRandomCall(node)) {
+          return;
+        }
+        if (isPartOfToString36Chain(node)) {
+          context.report({ node, messageId: "insecureRandomId" });
+          return;
+        }
+        const name = findEnclosingName(node);
+        if (name !== void 0 && NAME_PATTERN.test(name)) {
+          context.report({ node, messageId: "insecureRandomId" });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-json-stringify-error.ts
+import { ESLintUtils as ESLintUtils5 } from "@typescript-eslint/utils";
+var ERROR_NAME_PATTERN = /^(e|err|error|ex|exc)$/i;
+function isCatchBinding(scope, name) {
+  let current = scope;
+  while (current) {
+    const variable = current.set.get(name);
+    if (variable) {
+      for (const def of variable.defs) {
+        if (def.type === "CatchClause") {
+          return true;
+        }
+      }
+    }
+    current = current.upper;
+  }
+  return false;
+}
+function isJsonStringify(callee) {
+  return callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.object.name === "JSON" && callee.property.type === "Identifier" && callee.property.name === "stringify";
+}
+var no_json_stringify_error_default = ESLintUtils5.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-json-stringify-error",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `JSON.stringify` on an Error value; it yields `{}` because `message`/`stack` are non-enumerable."
+    },
+    schema: [],
+    messages: {
+      noJsonStringifyError: "`JSON.stringify` on an Error yields `{}` because `message`/`stack` are non-enumerable. Log `err.message` / `err.stack`, or use a proper error serializer."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isJsonStringify(node.callee)) {
+          return;
+        }
+        const firstArg = node.arguments[0];
+        if (!firstArg || firstArg.type !== "Identifier") {
+          return;
+        }
+        const name = firstArg.name;
+        const scope = context.sourceCode.getScope(firstArg);
+        if (ERROR_NAME_PATTERN.test(name) || isCatchBinding(scope, name)) {
+          context.report({
+            node,
+            messageId: "noJsonStringifyError"
+          });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-log-only-catch.ts
+import { ESLintUtils as ESLintUtils6 } from "@typescript-eslint/utils";
+var DEFAULT_IGNORE_PATTERNS2 = [
+  /\.test\./,
+  /\.spec\./,
+  /[\\/]__tests__[\\/]/
+];
+var CONSOLE_METHODS = /* @__PURE__ */ new Set([
+  "log",
+  "error",
+  "warn",
+  "info",
+  "debug"
+]);
+function isConsoleCallStatement(statement) {
+  if (statement.type !== "ExpressionStatement") {
+    return false;
+  }
+  const expr = statement.expression;
+  if (expr.type !== "CallExpression") {
+    return false;
+  }
+  const callee = expr.callee;
+  if (callee.type !== "MemberExpression") {
+    return false;
+  }
+  const { object, property } = callee;
+  if (object.type !== "Identifier" || object.name !== "console") {
+    return false;
+  }
+  if (callee.computed) {
+    return false;
+  }
+  if (property.type !== "Identifier") {
+    return false;
+  }
+  return CONSOLE_METHODS.has(property.name);
+}
+var no_log_only_catch_default = ESLintUtils6.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-log-only-catch",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `catch` clauses that only log (or do nothing) and then swallow the error; rethrow or handle it instead."
+    },
+    schema: [],
+    messages: {
+      noLogOnlyCatch: "Logging then swallowing the error hides failures. Rethrow the error or handle it for real."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const filename = context.filename;
+    const isIgnoredByDefault = DEFAULT_IGNORE_PATTERNS2.some(
+      (re) => re.test(filename)
+    );
+    if (isIgnoredByDefault) {
+      return {};
+    }
+    return {
+      CatchClause(node) {
+        const statements = node.body.body;
+        if (statements.length === 0) {
+          context.report({ node, messageId: "noLogOnlyCatch" });
+          return;
+        }
+        const everyStatementIsConsoleLog = statements.every(
+          (statement) => isConsoleCallStatement(statement)
+        );
+        if (everyStatementIsConsoleLog) {
+          context.report({ node, messageId: "noLogOnlyCatch" });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-raw-env.ts
+import { ESLintUtils as ESLintUtils7 } from "@typescript-eslint/utils";
+var no_raw_env_default = ESLintUtils7.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-raw-env",
@@ -355,10 +606,305 @@ var no_raw_env_default = ESLintUtils4.RuleCreator(
   }
 });
 
+// src/rules/no-sentinel-return-on-catch.ts
+import {
+  ESLintUtils as ESLintUtils8,
+  AST_NODE_TYPES as AST_NODE_TYPES3
+} from "@typescript-eslint/utils";
+function isSentinelArgument(arg) {
+  if (arg === null) {
+    return false;
+  }
+  if (arg.type === AST_NODE_TYPES3.Literal && arg.value === null) {
+    return true;
+  }
+  if (arg.type === AST_NODE_TYPES3.Literal && arg.value === false) {
+    return true;
+  }
+  if (arg.type === AST_NODE_TYPES3.Identifier && arg.name === "undefined") {
+    return true;
+  }
+  if (arg.type === AST_NODE_TYPES3.ArrayExpression && arg.elements.length === 0) {
+    return true;
+  }
+  if (arg.type === AST_NODE_TYPES3.ObjectExpression && arg.properties.length === 0) {
+    return true;
+  }
+  return false;
+}
+function containsThrow(node) {
+  let found = false;
+  const visit = (current) => {
+    if (found) {
+      return;
+    }
+    if (current.type === AST_NODE_TYPES3.ThrowStatement) {
+      found = true;
+      return;
+    }
+    if (current.type === AST_NODE_TYPES3.FunctionDeclaration || current.type === AST_NODE_TYPES3.FunctionExpression || current.type === AST_NODE_TYPES3.ArrowFunctionExpression) {
+      return;
+    }
+    for (const key of Object.keys(current)) {
+      if (key === "parent") {
+        continue;
+      }
+      const value = current[key];
+      if (Array.isArray(value)) {
+        for (const child of value) {
+          if (isNode(child)) {
+            visit(child);
+          }
+        }
+      } else if (isNode(value)) {
+        visit(value);
+      }
+    }
+  };
+  visit(node);
+  return found;
+}
+function isNode(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+var no_sentinel_return_on_catch_default = ESLintUtils8.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-sentinel-return-on-catch",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow swallowing a caught error by returning an empty sentinel (`null`, `undefined`, `false`, `[]`, `{}`) as the final statement of a `catch` block."
+    },
+    schema: [],
+    messages: {
+      noSentinelReturn: "This `catch` block swallows the error by returning an empty sentinel. Rethrow it, return a typed Result, or handle the error explicitly."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CatchClause(node) {
+        const body = node.body.body;
+        if (body.length === 0) {
+          return;
+        }
+        const last = body[body.length - 1];
+        if (last === void 0 || last.type !== AST_NODE_TYPES3.ReturnStatement) {
+          return;
+        }
+        if (!isSentinelArgument(last.argument)) {
+          return;
+        }
+        if (containsThrow(node.body)) {
+          return;
+        }
+        context.report({
+          node: last,
+          messageId: "noSentinelReturn"
+        });
+      }
+    };
+  }
+});
+
+// src/rules/no-sequential-await.ts
+import { ESLintUtils as ESLintUtils9 } from "@typescript-eslint/utils";
+function isFunctionLike(node) {
+  return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
+}
+function isLoop(node) {
+  return node.type === "ForStatement" || node.type === "ForOfStatement" || node.type === "ForInStatement" || node.type === "WhileStatement" || node.type === "DoWhileStatement";
+}
+var no_sequential_await_default = ESLintUtils9.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-sequential-await",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow serial `await` inside a loop; use `await Promise.all(...)` to run the operations concurrently."
+    },
+    schema: [],
+    messages: {
+      noSequentialAwait: "Avoid `await` inside a loop \u2014 it serializes I/O. Collect the promises and `await Promise.all(xs.map(async (x) => ...))` instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    function findAwaitInScope(node) {
+      if (node.type === "AwaitExpression") {
+        return node;
+      }
+      if (isFunctionLike(node)) {
+        return null;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent") {
+          continue;
+        }
+        const value = node[key];
+        if (Array.isArray(value)) {
+          for (const child of value) {
+            if (isNode2(child) && !isLoop(child)) {
+              const found = findAwaitInScope(child);
+              if (found) {
+                return found;
+              }
+            }
+          }
+        } else if (isNode2(value) && !isLoop(value)) {
+          const found = findAwaitInScope(value);
+          if (found) {
+            return found;
+          }
+        }
+      }
+      return null;
+    }
+    function isNode2(value) {
+      return typeof value === "object" && value !== null && typeof value.type === "string";
+    }
+    function checkLoop(node) {
+      const parts = [node.body];
+      if (node.type === "ForStatement") {
+        parts.push(node.init, node.test, node.update);
+      } else if (node.type === "ForOfStatement" || node.type === "ForInStatement") {
+        parts.push(node.right);
+      } else {
+        parts.push(node.test);
+      }
+      for (const part of parts) {
+        if (part && !isLoop(part) && findAwaitInScope(part)) {
+          context.report({ node, messageId: "noSequentialAwait" });
+          return;
+        }
+      }
+    }
+    return {
+      ForStatement: checkLoop,
+      ForInStatement: checkLoop,
+      WhileStatement: checkLoop,
+      DoWhileStatement: checkLoop,
+      ForOfStatement(node) {
+        if (node.await) {
+          return;
+        }
+        checkLoop(node);
+      }
+    };
+  }
+});
+
+// src/rules/no-string-concat-in-loop.ts
+import { ESLintUtils as ESLintUtils10 } from "@typescript-eslint/utils";
+var LOOP_NODE_TYPES = /* @__PURE__ */ new Set([
+  "ForStatement",
+  "ForOfStatement",
+  "ForInStatement",
+  "WhileStatement",
+  "DoWhileStatement"
+]);
+function isStringLiteralInit(node) {
+  if (node === null) {
+    return false;
+  }
+  if (node.type === "TemplateLiteral") {
+    return true;
+  }
+  if (node.type === "Literal") {
+    return typeof node.value === "string";
+  }
+  return false;
+}
+function findVariable(scope, name) {
+  let current = scope;
+  while (current !== null) {
+    const variable = current.variables.find((v) => v.name === name);
+    if (variable !== void 0) {
+      return variable;
+    }
+    current = current.upper;
+  }
+  return void 0;
+}
+function isStringInitializedVariable(variable) {
+  if (variable.defs.length !== 1) {
+    return false;
+  }
+  const def = variable.defs[0];
+  if (def === void 0 || def.type !== "Variable") {
+    return false;
+  }
+  const declarator = def.node;
+  if (declarator.type !== "VariableDeclarator") {
+    return false;
+  }
+  return isStringLiteralInit(declarator.init);
+}
+function isInsideLoopBody(node) {
+  let child = node;
+  let parent = node.parent;
+  while (parent !== void 0 && parent !== null) {
+    if (LOOP_NODE_TYPES.has(parent.type)) {
+      const loop = parent;
+      if (loop.body === child) {
+        return true;
+      }
+    }
+    child = parent;
+    parent = parent.parent;
+  }
+  return false;
+}
+var no_string_concat_in_loop_default = ESLintUtils10.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-string-concat-in-loop",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow O(n^2) string building via `+=` on a string variable inside a loop; push parts to an array and `join` instead."
+    },
+    schema: [],
+    messages: {
+      noStringConcatInLoop: 'Avoid building a string with `+=` inside a loop \u2014 this is O(n^2). Push the parts onto an array and use `arr.join("")` after the loop.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      AssignmentExpression(node) {
+        if (node.operator !== "+=") {
+          return;
+        }
+        if (node.left.type !== "Identifier") {
+          return;
+        }
+        if (!isInsideLoopBody(node)) {
+          return;
+        }
+        const scope = context.sourceCode.getScope(node);
+        const variable = findVariable(scope, node.left.name);
+        if (variable === void 0) {
+          return;
+        }
+        if (!isStringInitializedVariable(variable)) {
+          return;
+        }
+        context.report({
+          node,
+          messageId: "noStringConcatInLoop"
+        });
+      }
+    };
+  }
+});
+
 // src/rules/no-unnecessary-use-client.ts
 import {
-  AST_NODE_TYPES as AST_NODE_TYPES3,
-  ESLintUtils as ESLintUtils5
+  AST_NODE_TYPES as AST_NODE_TYPES4,
+  ESLintUtils as ESLintUtils11
 } from "@typescript-eslint/utils";
 var HOOK_REGEX = /^use([A-Z]|$)/;
 var EVENT_PROP_REGEX = /^on[A-Z]/;
@@ -382,16 +928,16 @@ var BROWSER_GLOBALS = /* @__PURE__ */ new Set([
 ]);
 var CLIENT_ONLY_PACKAGES_REGEX = /^(?:@radix-ui\/|framer-motion|react-dom|react-day-picker|@floating-ui\/|react-select|react-toastify|react-hook-form|recharts|react-dropzone|react-slick|react-swipeable|react-resizable|react-draggable|react-beautiful-dnd|@hello-pangea\/dnd|react-virtualized|react-window|@tanstack\/react-table|@tanstack\/react-query|react-redux|recoil|jotai|zustand|@tippyjs\/react|react-color|react-datepicker|next-themes|react-helmet|react-helmet-async|styled-components|@emotion\/)/;
 var isUseClientDirective = (node) => {
-  return node.type === AST_NODE_TYPES3.ExpressionStatement && node.expression.type === AST_NODE_TYPES3.Literal && node.expression.value === "use client";
+  return node.type === AST_NODE_TYPES4.ExpressionStatement && node.expression.type === AST_NODE_TYPES4.Literal && node.expression.value === "use client";
 };
 var isGlobalReference = (node, context) => {
   if (!BROWSER_GLOBALS.has(node.name)) return false;
   const parent = node.parent;
   if (parent !== void 0) {
-    if (parent.type === AST_NODE_TYPES3.MemberExpression && parent.property === node && !parent.computed) {
+    if (parent.type === AST_NODE_TYPES4.MemberExpression && parent.property === node && !parent.computed) {
       return false;
     }
-    if (parent.type === AST_NODE_TYPES3.Property && parent.key === node && !parent.computed) {
+    if (parent.type === AST_NODE_TYPES4.Property && parent.key === node && !parent.computed) {
       return false;
     }
     if (parent.type.startsWith("TS")) {
@@ -408,7 +954,7 @@ var isGlobalReference = (node, context) => {
   }
   return true;
 };
-var no_unnecessary_use_client_default = ESLintUtils5.RuleCreator(
+var no_unnecessary_use_client_default = ESLintUtils11.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-unnecessary-use-client",
@@ -431,13 +977,13 @@ var no_unnecessary_use_client_default = ESLintUtils5.RuleCreator(
     let directiveNode = null;
     let hasClientIndicator = false;
     const markIfHookOrContext = (callee) => {
-      if (callee.type === AST_NODE_TYPES3.Identifier) {
+      if (callee.type === AST_NODE_TYPES4.Identifier) {
         if (HOOK_REGEX.test(callee.name) || callee.name === "createContext") {
           hasClientIndicator = true;
         }
         return;
       }
-      if (callee.type === AST_NODE_TYPES3.MemberExpression && callee.property.type === AST_NODE_TYPES3.Identifier) {
+      if (callee.type === AST_NODE_TYPES4.MemberExpression && callee.property.type === AST_NODE_TYPES4.Identifier) {
         const name = callee.property.name;
         if (HOOK_REGEX.test(name) || name === "createContext") {
           hasClientIndicator = true;
@@ -447,7 +993,7 @@ var no_unnecessary_use_client_default = ESLintUtils5.RuleCreator(
     return {
       Program(node) {
         for (const stmt of node.body) {
-          if (stmt.type !== AST_NODE_TYPES3.ExpressionStatement) break;
+          if (stmt.type !== AST_NODE_TYPES4.ExpressionStatement) break;
           if (isUseClientDirective(stmt)) {
             directiveNode = stmt;
             break;
@@ -458,7 +1004,7 @@ var no_unnecessary_use_client_default = ESLintUtils5.RuleCreator(
         markIfHookOrContext(node.callee);
       },
       JSXAttribute(node) {
-        if (node.name.type === AST_NODE_TYPES3.JSXIdentifier && EVENT_PROP_REGEX.test(node.name.name)) {
+        if (node.name.type === AST_NODE_TYPES4.JSXIdentifier && EVENT_PROP_REGEX.test(node.name.name)) {
           hasClientIndicator = true;
         }
       },
@@ -500,17 +1046,101 @@ var no_unnecessary_use_client_default = ESLintUtils5.RuleCreator(
   }
 });
 
+// src/rules/prefer-discriminated-union.ts
+import { ESLintUtils as ESLintUtils12 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES5 } from "@typescript-eslint/utils";
+var STATUS_MEMBER_NAMES = /* @__PURE__ */ new Set([
+  "success",
+  "ok",
+  "error",
+  "failed",
+  "isError"
+]);
+var MIN_OPTIONAL_MEMBERS = 2;
+function getMemberName(member) {
+  if (member.type !== AST_NODE_TYPES5.TSPropertySignature) {
+    return null;
+  }
+  const { key } = member;
+  if (key.type === AST_NODE_TYPES5.Identifier) {
+    return key.name;
+  }
+  if (key.type === AST_NODE_TYPES5.Literal && typeof key.value === "string") {
+    return key.value;
+  }
+  return null;
+}
+function isBooleanTyped(member) {
+  return member.typeAnnotation?.typeAnnotation.type === AST_NODE_TYPES5.TSBooleanKeyword;
+}
+function looksLikeMutuallyExclusiveState(typeLiteral) {
+  let hasStatusBoolean = false;
+  let optionalCount = 0;
+  for (const member of typeLiteral.members) {
+    if (member.type !== AST_NODE_TYPES5.TSPropertySignature) {
+      continue;
+    }
+    if (member.optional) {
+      optionalCount += 1;
+    }
+    const name = getMemberName(member);
+    if (name !== null && STATUS_MEMBER_NAMES.has(name) && isBooleanTyped(member)) {
+      hasStatusBoolean = true;
+    }
+  }
+  return hasStatusBoolean && optionalCount >= MIN_OPTIONAL_MEMBERS;
+}
+var prefer_discriminated_union_default = ESLintUtils12.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-discriminated-union",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Flag object types with a boolean status flag and many optionals; model them as a discriminated union instead."
+    },
+    schema: [],
+    messages: {
+      preferDiscriminatedUnion: "This object type uses a boolean status flag alongside several optional fields, which lets illegal states be representable. Model it as a `z.discriminatedUnion` / discriminated union (e.g. `{ ok: true; data: T } | { ok: false; error: E }`) to make illegal states unrepresentable."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    function checkTypeLiteral(typeLiteral, reportNode) {
+      if (looksLikeMutuallyExclusiveState(typeLiteral)) {
+        context.report({
+          node: reportNode,
+          messageId: "preferDiscriminatedUnion"
+        });
+      }
+    }
+    return {
+      TSInterfaceDeclaration(node) {
+        const synthetic = {
+          ...node.body,
+          type: AST_NODE_TYPES5.TSTypeLiteral,
+          members: node.body.body
+        };
+        checkTypeLiteral(synthetic, node);
+      },
+      "TSTypeAliasDeclaration > TSTypeLiteral"(node) {
+        checkTypeLiteral(node, node.parent);
+      }
+    };
+  }
+});
+
 // src/rules/prefer-schema-for-api-payload.ts
 import {
-  AST_NODE_TYPES as AST_NODE_TYPES4,
-  ESLintUtils as ESLintUtils6
+  AST_NODE_TYPES as AST_NODE_TYPES6,
+  ESLintUtils as ESLintUtils13
 } from "@typescript-eslint/utils";
 var unwrap = (node) => {
   let current = node;
   while (current !== null && current !== void 0) {
-    if (current.type === AST_NODE_TYPES4.TSAsExpression || current.type === AST_NODE_TYPES4.TSTypeAssertion || current.type === AST_NODE_TYPES4.TSNonNullExpression || current.type === AST_NODE_TYPES4.TSSatisfiesExpression) {
+    if (current.type === AST_NODE_TYPES6.TSAsExpression || current.type === AST_NODE_TYPES6.TSTypeAssertion || current.type === AST_NODE_TYPES6.TSNonNullExpression || current.type === AST_NODE_TYPES6.TSSatisfiesExpression) {
       current = current.expression;
-    } else if (current.type === AST_NODE_TYPES4.ChainExpression) {
+    } else if (current.type === AST_NODE_TYPES6.ChainExpression) {
       current = current.expression;
     } else {
       break;
@@ -521,20 +1151,20 @@ var unwrap = (node) => {
 var isJsonCall = (node) => {
   let current = unwrap(node);
   if (current === null) return false;
-  if (current.type === AST_NODE_TYPES4.AwaitExpression) {
+  if (current.type === AST_NODE_TYPES6.AwaitExpression) {
     current = unwrap(current.argument);
   }
-  if (current === null || current.type !== AST_NODE_TYPES4.CallExpression) {
+  if (current === null || current.type !== AST_NODE_TYPES6.CallExpression) {
     return false;
   }
   const callee = unwrap(current.callee);
-  if (callee === null || callee.type !== AST_NODE_TYPES4.MemberExpression) {
+  if (callee === null || callee.type !== AST_NODE_TYPES6.MemberExpression) {
     return false;
   }
   const property = unwrap(callee.property);
-  return property !== null && property.type === AST_NODE_TYPES4.Identifier && property.name === "json";
+  return property !== null && property.type === AST_NODE_TYPES6.Identifier && property.name === "json";
 };
-var findVariable = (scope, name) => {
+var findVariable2 = (scope, name) => {
   let current = scope;
   while (current !== null) {
     const variable = current.set.get(name);
@@ -545,13 +1175,13 @@ var findVariable = (scope, name) => {
 };
 var isUnvalidatedVariableRef = (node, scope, tracked) => {
   const unwrapped = unwrap(node);
-  if (unwrapped === null || unwrapped.type !== AST_NODE_TYPES4.Identifier) {
+  if (unwrapped === null || unwrapped.type !== AST_NODE_TYPES6.Identifier) {
     return false;
   }
-  const variable = findVariable(scope, unwrapped.name);
+  const variable = findVariable2(scope, unwrapped.name);
   return variable !== null && tracked.has(variable);
 };
-var prefer_schema_for_api_payload_default = ESLintUtils6.RuleCreator(
+var prefer_schema_for_api_payload_default = ESLintUtils13.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-schema-for-api-payload",
@@ -579,11 +1209,11 @@ var prefer_schema_for_api_payload_default = ESLintUtils6.RuleCreator(
     return {
       VariableDeclarator(node) {
         const scope = context.sourceCode.getScope(node);
-        if (node.id.type === AST_NODE_TYPES4.Identifier) {
+        if (node.id.type === AST_NODE_TYPES6.Identifier) {
           trackInitializer(node);
           return;
         }
-        if (node.id.type === AST_NODE_TYPES4.ObjectPattern || node.id.type === AST_NODE_TYPES4.ArrayPattern) {
+        if (node.id.type === AST_NODE_TYPES6.ObjectPattern || node.id.type === AST_NODE_TYPES6.ArrayPattern) {
           if (isJsonCall(node.init)) {
             context.report({ node: node.id, messageId: "unparsedJsonAccess" });
             return;
@@ -595,8 +1225,8 @@ var prefer_schema_for_api_payload_default = ESLintUtils6.RuleCreator(
       },
       AssignmentExpression(node) {
         const scope = context.sourceCode.getScope(node);
-        if (node.left.type === AST_NODE_TYPES4.Identifier) {
-          const variable = findVariable(scope, node.left.name);
+        if (node.left.type === AST_NODE_TYPES6.Identifier) {
+          const variable = findVariable2(scope, node.left.name);
           if (variable === null) return;
           if (isJsonCall(node.right)) {
             unvalidatedVariables.add(variable);
@@ -605,7 +1235,7 @@ var prefer_schema_for_api_payload_default = ESLintUtils6.RuleCreator(
           }
           return;
         }
-        if (node.left.type === AST_NODE_TYPES4.ObjectPattern || node.left.type === AST_NODE_TYPES4.ArrayPattern) {
+        if (node.left.type === AST_NODE_TYPES6.ObjectPattern || node.left.type === AST_NODE_TYPES6.ArrayPattern) {
           if (isJsonCall(node.right)) {
             context.report({
               node: node.left,
@@ -626,15 +1256,15 @@ var prefer_schema_for_api_payload_default = ESLintUtils6.RuleCreator(
         const obj = unwrap(node.object);
         if (isJsonCall(obj)) {
           const parent = node.parent;
-          if (parent.type === AST_NODE_TYPES4.CallExpression && parent.callee === node && node.property.type === AST_NODE_TYPES4.Identifier && (node.property.name === "parse" || node.property.name === "safeParse")) {
+          if (parent.type === AST_NODE_TYPES6.CallExpression && parent.callee === node && node.property.type === AST_NODE_TYPES6.Identifier && (node.property.name === "parse" || node.property.name === "safeParse")) {
             return;
           }
           context.report({ node, messageId: "unparsedJsonAccess" });
           return;
         }
-        if (obj !== null && obj.type === AST_NODE_TYPES4.Identifier && isUnvalidatedVariableRef(obj, scope, unvalidatedVariables)) {
+        if (obj !== null && obj.type === AST_NODE_TYPES6.Identifier && isUnvalidatedVariableRef(obj, scope, unvalidatedVariables)) {
           context.report({ node, messageId: "unparsedJsonAccess" });
-          const variable = findVariable(scope, obj.name);
+          const variable = findVariable2(scope, obj.name);
           if (variable !== null) {
             unvalidatedVariables.delete(variable);
           }
@@ -645,7 +1275,7 @@ var prefer_schema_for_api_payload_default = ESLintUtils6.RuleCreator(
 });
 
 // src/rules/prefer-server-actions.ts
-import { ESLintUtils as ESLintUtils7 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils14 } from "@typescript-eslint/utils";
 var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE", "PATCH"]);
 var AXIOS_MUTATION_METHODS = /* @__PURE__ */ new Set(["post", "put", "delete", "patch"]);
 var SKIP_FILE_REGEX = /(?:\.test\.[jt]sx?$|\.spec\.[jt]sx?$|\/tests?\/|\/__tests__\/|\/scripts?\/|\/app\/api\/.*\/route\.[jt]sx?$|\/pages\/api\/)/;
@@ -724,7 +1354,7 @@ function getPropertyNode(objNode, propName) {
   }
   return null;
 }
-var prefer_server_actions_default = ESLintUtils7.RuleCreator(
+var prefer_server_actions_default = ESLintUtils14.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-server-actions",
@@ -789,14 +1419,14 @@ var prefer_server_actions_default = ESLintUtils7.RuleCreator(
 });
 
 // src/rules/prefer-shadcn.ts
-import { ESLintUtils as ESLintUtils8 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils15 } from "@typescript-eslint/utils";
 var REPLACEMENTS = {
   input: "Input",
   select: "Select",
   textarea: "Textarea",
   dialog: "Dialog"
 };
-var prefer_shadcn_default = ESLintUtils8.RuleCreator(
+var prefer_shadcn_default = ESLintUtils15.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-shadcn",
@@ -837,25 +1467,25 @@ var prefer_shadcn_default = ESLintUtils8.RuleCreator(
 });
 
 // src/rules/require-assert-never.ts
-import { ESLintUtils as ESLintUtils9, AST_NODE_TYPES as AST_NODE_TYPES5 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils16, AST_NODE_TYPES as AST_NODE_TYPES7 } from "@typescript-eslint/utils";
 var isAssertNeverCall = (expression) => {
-  if (expression.type !== AST_NODE_TYPES5.CallExpression) return false;
+  if (expression.type !== AST_NODE_TYPES7.CallExpression) return false;
   const callee = expression.callee;
-  return callee.type === AST_NODE_TYPES5.Identifier && callee.name === "assertNever";
+  return callee.type === AST_NODE_TYPES7.Identifier && callee.name === "assertNever";
 };
 var statementContainsAssertNever = (statement) => {
-  if (statement.type === AST_NODE_TYPES5.ExpressionStatement) {
+  if (statement.type === AST_NODE_TYPES7.ExpressionStatement) {
     return isAssertNeverCall(statement.expression);
   }
-  if (statement.type === AST_NODE_TYPES5.ThrowStatement) {
+  if (statement.type === AST_NODE_TYPES7.ThrowStatement) {
     return isAssertNeverCall(statement.argument);
   }
-  if (statement.type === AST_NODE_TYPES5.BlockStatement) {
+  if (statement.type === AST_NODE_TYPES7.BlockStatement) {
     return statement.body.some(statementContainsAssertNever);
   }
   return false;
 };
-var require_assert_never_default = ESLintUtils9.RuleCreator(
+var require_assert_never_default = ESLintUtils16.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "require-assert-never",
@@ -891,22 +1521,22 @@ var require_assert_never_default = ESLintUtils9.RuleCreator(
 });
 
 // src/rules/require-zod-form-validation.ts
-import { ESLintUtils as ESLintUtils10, AST_NODE_TYPES as AST_NODE_TYPES6 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils17, AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
 var isFormDataGetCall = (node) => {
   const callee = node.callee;
-  if (callee.type !== AST_NODE_TYPES6.MemberExpression) return false;
-  if (callee.property.type !== AST_NODE_TYPES6.Identifier || callee.property.name !== "get") {
+  if (callee.type !== AST_NODE_TYPES8.MemberExpression) return false;
+  if (callee.property.type !== AST_NODE_TYPES8.Identifier || callee.property.name !== "get") {
     return false;
   }
-  return callee.object.type === AST_NODE_TYPES6.Identifier && callee.object.name === "formData";
+  return callee.object.type === AST_NODE_TYPES8.Identifier && callee.object.name === "formData";
 };
 var isParseCallExpression = (node) => {
-  if (node.type !== AST_NODE_TYPES6.CallExpression) return false;
+  if (node.type !== AST_NODE_TYPES8.CallExpression) return false;
   const callee = node.callee;
-  if (callee.type !== AST_NODE_TYPES6.MemberExpression) return false;
-  return callee.property.type === AST_NODE_TYPES6.Identifier && callee.property.name === "parse";
+  if (callee.type !== AST_NODE_TYPES8.MemberExpression) return false;
+  return callee.property.type === AST_NODE_TYPES8.Identifier && callee.property.name === "parse";
 };
-var require_zod_form_validation_default = ESLintUtils10.RuleCreator(
+var require_zod_form_validation_default = ESLintUtils17.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "require-zod-form-validation",
@@ -940,15 +1570,15 @@ var require_zod_form_validation_default = ESLintUtils10.RuleCreator(
 });
 
 // src/rules/zod-naming-convention.ts
-import { ESLintUtils as ESLintUtils11, AST_NODE_TYPES as AST_NODE_TYPES7 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils18, AST_NODE_TYPES as AST_NODE_TYPES9 } from "@typescript-eslint/utils";
 var calleeChainStartsWithZ = (node) => {
   let current = node;
-  while (current.type === AST_NODE_TYPES7.MemberExpression) {
+  while (current.type === AST_NODE_TYPES9.MemberExpression) {
     const receiver = current.object;
-    if (receiver.type === AST_NODE_TYPES7.Identifier && receiver.name === "z") {
+    if (receiver.type === AST_NODE_TYPES9.Identifier && receiver.name === "z") {
       return true;
     }
-    if (receiver.type === AST_NODE_TYPES7.CallExpression) {
+    if (receiver.type === AST_NODE_TYPES9.CallExpression) {
       current = receiver.callee;
       continue;
     }
@@ -956,7 +1586,7 @@ var calleeChainStartsWithZ = (node) => {
   }
   return false;
 };
-var zod_naming_convention_default = ESLintUtils11.RuleCreator(
+var zod_naming_convention_default = ESLintUtils18.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "zod-naming-convention",
@@ -976,11 +1606,11 @@ var zod_naming_convention_default = ESLintUtils11.RuleCreator(
       VariableDeclarator(node) {
         const init = node.init;
         if (init === null || init === void 0) return;
-        if (init.type !== AST_NODE_TYPES7.CallExpression) return;
+        if (init.type !== AST_NODE_TYPES9.CallExpression) return;
         const callee = init.callee;
-        if (callee.type !== AST_NODE_TYPES7.MemberExpression) return;
+        if (callee.type !== AST_NODE_TYPES9.MemberExpression) return;
         if (!calleeChainStartsWithZ(callee)) return;
-        if (node.id.type !== AST_NODE_TYPES7.Identifier) return;
+        if (node.id.type !== AST_NODE_TYPES9.Identifier) return;
         const variableName = node.id.name;
         if (variableName.startsWith("Z")) return;
         context.report({
@@ -997,8 +1627,15 @@ var rules = {
   "enforce-file-structure": enforce_file_structure_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
   "no-enum": no_enum_default,
+  "no-insecure-random-id": no_insecure_random_id_default,
+  "no-json-stringify-error": no_json_stringify_error_default,
+  "no-log-only-catch": no_log_only_catch_default,
   "no-raw-env": no_raw_env_default,
+  "no-sentinel-return-on-catch": no_sentinel_return_on_catch_default,
+  "no-sequential-await": no_sequential_await_default,
+  "no-string-concat-in-loop": no_string_concat_in_loop_default,
   "no-unnecessary-use-client": no_unnecessary_use_client_default,
+  "prefer-discriminated-union": prefer_discriminated_union_default,
   "prefer-schema-for-api-payload": prefer_schema_for_api_payload_default,
   "prefer-server-actions": prefer_server_actions_default,
   "prefer-shadcn": prefer_shadcn_default,
@@ -1009,7 +1646,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.0.0"
+    version: "2.1.1"
   },
   rules,
   configs: {
@@ -1023,7 +1660,15 @@ var plugin = {
         "@sarj/no-client-side-data-fetching": "warn",
         "@sarj/prefer-server-actions": "warn",
         "@sarj/no-unnecessary-use-client": "warn",
-        "@sarj/prefer-schema-for-api-payload": "warn"
+        "@sarj/prefer-schema-for-api-payload": "warn",
+        // Distilled from sarj-audit skills — warn in recommended, error in strict.
+        "@sarj/no-sequential-await": "warn",
+        "@sarj/no-sentinel-return-on-catch": "warn",
+        "@sarj/no-log-only-catch": "warn",
+        "@sarj/no-insecure-random-id": "warn",
+        "@sarj/no-json-stringify-error": "warn",
+        "@sarj/no-string-concat-in-loop": "warn",
+        "@sarj/prefer-discriminated-union": "warn"
       }
     },
     strict: {
@@ -1039,7 +1684,15 @@ var plugin = {
         "@sarj/no-client-side-data-fetching": "error",
         "@sarj/prefer-server-actions": "error",
         "@sarj/no-unnecessary-use-client": "error",
-        "@sarj/prefer-schema-for-api-payload": "error"
+        "@sarj/prefer-schema-for-api-payload": "error",
+        // Distilled from sarj-audit skills.
+        "@sarj/no-sequential-await": "error",
+        "@sarj/no-sentinel-return-on-catch": "error",
+        "@sarj/no-log-only-catch": "error",
+        "@sarj/no-insecure-random-id": "error",
+        "@sarj/no-json-stringify-error": "error",
+        "@sarj/no-string-concat-in-loop": "error",
+        "@sarj/prefer-discriminated-union": "error"
       }
     }
   }